c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe
Size

468KB
MD5

74bb6bd6c0e39da64969c6f55037f4a0
SHA1

2431e701795d964dff1450b61d34795a08f82743
SHA256

c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11
SHA512

889b081bc8e8beaa97a69d50c3038271539d8a6e3d8213cf533204e0f6f1cd4b93a721470838e6869af25900249a2e4835319b8a4cb1b5667deec6a9dee1245e
SSDEEP

3072:thgIo6Ldjs8b6mYCfz52ff5ECZj+IpBnmHdKVqM2Is3fYNOm5ld:thLoOhb62f12ffs0EO2IiQNOm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3280	Unicorn-20491.exe
4580	Unicorn-7626.exe
1384	Unicorn-56121.exe
4416	Unicorn-13537.exe
3680	Unicorn-23743.exe
3184	Unicorn-29874.exe
3352	Unicorn-10008.exe
4608	Unicorn-41851.exe
4236	Unicorn-8472.exe
5024	Unicorn-57611.exe
1508	Unicorn-11233.exe
4804	Unicorn-51289.exe
3040	Unicorn-57419.exe
436	Unicorn-59977.exe
4488	Unicorn-7704.exe
3720	Unicorn-12497.exe
2912	Unicorn-5761.exe
2992	Unicorn-25243.exe
1156	Unicorn-24815.exe
2344	Unicorn-30562.exe
2348	Unicorn-39777.exe
3968	Unicorn-12362.exe
4736	Unicorn-44843.exe
3764	Unicorn-28050.exe
3268	Unicorn-57650.exe
4348	Unicorn-11978.exe
4900	Unicorn-44459.exe
1844	Unicorn-12584.exe
4700	Unicorn-1864.exe
5068	Unicorn-12799.exe
1212	Unicorn-14801.exe
1228	Unicorn-14817.exe
3888	Unicorn-40945.exe
1172	Unicorn-11418.exe
5036	Unicorn-60619.exe
3460	Unicorn-56985.exe
4568	Unicorn-26721.exe
1244	Unicorn-49218.exe
1516	Unicorn-15704.exe
2436	Unicorn-15970.exe
2880	Unicorn-62155.exe
4400	Unicorn-61536.exe
4924	Unicorn-47801.exe
536	Unicorn-33842.exe
4356	Unicorn-12305.exe
856	Unicorn-55627.exe
1852	Unicorn-55051.exe
4852	Unicorn-35185.exe
216	Unicorn-64681.exe
440	Unicorn-57298.exe
868	Unicorn-57298.exe
1812	Unicorn-21419.exe
736	Unicorn-10977.exe
3236	Unicorn-7578.exe
1136	Unicorn-56265.exe
548	Unicorn-31313.exe
2356	Unicorn-56779.exe
1628	Unicorn-26930.exe
2420	Unicorn-1279.exe
4632	Unicorn-55881.exe
2952	Unicorn-33928.exe
2428	Unicorn-36913.exe
2896	Unicorn-39794.exe
5080	Unicorn-43131.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
12344	7924	WerFault.exe	407
15736	4756	WerFault.exe	656

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31313.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34616.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	13648	dwm.exe
Token: SeChangeNotifyPrivilege	13648	dwm.exe
Token: 33	13648	dwm.exe
Token: SeIncBasePriorityPrivilege	13648	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe
3280	Unicorn-20491.exe
4580	Unicorn-7626.exe
1384	Unicorn-56121.exe
4416	Unicorn-13537.exe
3352	Unicorn-10008.exe
3680	Unicorn-23743.exe
3184	Unicorn-29874.exe
4608	Unicorn-41851.exe
4236	Unicorn-8472.exe
3040	Unicorn-57419.exe
1508	Unicorn-11233.exe
4804	Unicorn-51289.exe
5024	Unicorn-57611.exe
4488	Unicorn-7704.exe
436	Unicorn-59977.exe
3720	Unicorn-12497.exe
2912	Unicorn-5761.exe
2992	Unicorn-25243.exe
1156	Unicorn-24815.exe
2344	Unicorn-30562.exe
2348	Unicorn-39777.exe
3968	Unicorn-12362.exe
4736	Unicorn-44843.exe
1844	Unicorn-12584.exe
1212	Unicorn-14801.exe
5068	Unicorn-12799.exe
3764	Unicorn-28050.exe
4700	Unicorn-1864.exe
4348	Unicorn-11978.exe
3268	Unicorn-57650.exe
4900	Unicorn-44459.exe
1228	Unicorn-14817.exe
3888	Unicorn-40945.exe
1172	Unicorn-11418.exe
5036	Unicorn-60619.exe
3460	Unicorn-56985.exe
4568	Unicorn-26721.exe
1244	Unicorn-49218.exe
2880	Unicorn-62155.exe
2436	Unicorn-15970.exe
1516	Unicorn-15704.exe
4924	Unicorn-47801.exe
4400	Unicorn-61536.exe
536	Unicorn-33842.exe
4356	Unicorn-12305.exe
856	Unicorn-55627.exe
4852	Unicorn-35185.exe
1852	Unicorn-55051.exe
868	Unicorn-57298.exe
1812	Unicorn-21419.exe
2420	Unicorn-1279.exe
548	Unicorn-31313.exe
3236	Unicorn-7578.exe
216	Unicorn-64681.exe
2356	Unicorn-56779.exe
2952	Unicorn-33928.exe
736	Unicorn-10977.exe
440	Unicorn-57298.exe
1136	Unicorn-56265.exe
1628	Unicorn-26930.exe
2428	Unicorn-36913.exe
4632	Unicorn-55881.exe
2896	Unicorn-39794.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 3280	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	86
PID 732 wrote to memory of 3280	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	86
PID 732 wrote to memory of 3280	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	86
PID 3280 wrote to memory of 4580	3280	Unicorn-20491.exe	87
PID 3280 wrote to memory of 4580	3280	Unicorn-20491.exe	87
PID 3280 wrote to memory of 4580	3280	Unicorn-20491.exe	87
PID 732 wrote to memory of 1384	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	88
PID 732 wrote to memory of 1384	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	88
PID 732 wrote to memory of 1384	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	88
PID 4580 wrote to memory of 4416	4580	Unicorn-7626.exe	89
PID 4580 wrote to memory of 4416	4580	Unicorn-7626.exe	89
PID 4580 wrote to memory of 4416	4580	Unicorn-7626.exe	89
PID 732 wrote to memory of 3680	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	91
PID 732 wrote to memory of 3680	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	91
PID 732 wrote to memory of 3680	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	91
PID 1384 wrote to memory of 3184	1384	Unicorn-56121.exe	90
PID 1384 wrote to memory of 3184	1384	Unicorn-56121.exe	90
PID 1384 wrote to memory of 3184	1384	Unicorn-56121.exe	90
PID 3280 wrote to memory of 3352	3280	Unicorn-20491.exe	92
PID 3280 wrote to memory of 3352	3280	Unicorn-20491.exe	92
PID 3280 wrote to memory of 3352	3280	Unicorn-20491.exe	92
PID 4416 wrote to memory of 4608	4416	Unicorn-13537.exe	93
PID 4416 wrote to memory of 4608	4416	Unicorn-13537.exe	93
PID 4416 wrote to memory of 4608	4416	Unicorn-13537.exe	93
PID 4580 wrote to memory of 4236	4580	Unicorn-7626.exe	94
PID 4580 wrote to memory of 4236	4580	Unicorn-7626.exe	94
PID 4580 wrote to memory of 4236	4580	Unicorn-7626.exe	94
PID 3352 wrote to memory of 5024	3352	Unicorn-10008.exe	95
PID 3352 wrote to memory of 5024	3352	Unicorn-10008.exe	95
PID 3352 wrote to memory of 5024	3352	Unicorn-10008.exe	95
PID 3680 wrote to memory of 1508	3680	Unicorn-23743.exe	96
PID 3680 wrote to memory of 1508	3680	Unicorn-23743.exe	96
PID 3680 wrote to memory of 1508	3680	Unicorn-23743.exe	96
PID 3280 wrote to memory of 4804	3280	Unicorn-20491.exe	97
PID 3280 wrote to memory of 4804	3280	Unicorn-20491.exe	97
PID 3280 wrote to memory of 4804	3280	Unicorn-20491.exe	97
PID 3184 wrote to memory of 3040	3184	Unicorn-29874.exe	98
PID 3184 wrote to memory of 3040	3184	Unicorn-29874.exe	98
PID 3184 wrote to memory of 3040	3184	Unicorn-29874.exe	98
PID 732 wrote to memory of 436	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	99
PID 732 wrote to memory of 436	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	99
PID 732 wrote to memory of 436	732	c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe	99
PID 1384 wrote to memory of 4488	1384	Unicorn-56121.exe	100
PID 1384 wrote to memory of 4488	1384	Unicorn-56121.exe	100
PID 1384 wrote to memory of 4488	1384	Unicorn-56121.exe	100
PID 4608 wrote to memory of 3720	4608	Unicorn-41851.exe	101
PID 4608 wrote to memory of 3720	4608	Unicorn-41851.exe	101
PID 4608 wrote to memory of 3720	4608	Unicorn-41851.exe	101
PID 4416 wrote to memory of 2912	4416	Unicorn-13537.exe	102
PID 4416 wrote to memory of 2912	4416	Unicorn-13537.exe	102
PID 4416 wrote to memory of 2912	4416	Unicorn-13537.exe	102
PID 4236 wrote to memory of 2992	4236	Unicorn-8472.exe	103
PID 4236 wrote to memory of 2992	4236	Unicorn-8472.exe	103
PID 4236 wrote to memory of 2992	4236	Unicorn-8472.exe	103
PID 4580 wrote to memory of 1156	4580	Unicorn-7626.exe	104
PID 4580 wrote to memory of 1156	4580	Unicorn-7626.exe	104
PID 4580 wrote to memory of 1156	4580	Unicorn-7626.exe	104
PID 3040 wrote to memory of 2344	3040	Unicorn-57419.exe	105
PID 3040 wrote to memory of 2344	3040	Unicorn-57419.exe	105
PID 3040 wrote to memory of 2344	3040	Unicorn-57419.exe	105
PID 3184 wrote to memory of 2348	3184	Unicorn-29874.exe	106
PID 3184 wrote to memory of 2348	3184	Unicorn-29874.exe	106
PID 3184 wrote to memory of 2348	3184	Unicorn-29874.exe	106
PID 1508 wrote to memory of 3968	1508	Unicorn-11233.exe	107

C:\Users\Admin\AppData\Local\Temp\c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe
"C:\Users\Admin\AppData\Local\Temp\c3f5029f3a3fc03cd9cd4c165902e3478931e890d7d4007cbf57eb0caacf1b11N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
        9⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        10⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        11⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48178.exe
        11⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        11⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        10⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        10⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        10⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31457.exe
        10⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
        10⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        9⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54187.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4616.exe
        9⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        7⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        8⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        9⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        9⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        9⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        8⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62121.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1530.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        7⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40945.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16427.exe
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51915.exe
        9⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        10⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        10⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        9⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        8⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33496.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
        6⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2449.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11576.exe
        6⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        9⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        9⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63065.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21836.exe
        7⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        6⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
        9⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        8⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30280.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        7⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18872.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63330.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63689.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        7⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
        6⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56985.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4209.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40345.exe
        7⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30689.exe
        7⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50320.exe
        6⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51138.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48852.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        6⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51058.exe
        5⤵
        
        PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65435.exe
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41938.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        9⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        10⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        10⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        9⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51408.exe
        9⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53137.exe
        9⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39480.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27896.exe
        7⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
        6⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        9⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        9⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        9⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45193.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        7⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15105.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
        7⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60457.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        6⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25419.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54626.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16901.exe
        7⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7155.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45069.exe
        7⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
        6⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 488
        7⤵
        Program crash
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        6⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        5⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36241.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53328.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        6⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        5⤵
        
        PID:15688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55378.exe
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64914.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20881.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        7⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        7⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5137.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40482.exe
        6⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        5⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        6⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64946.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50953.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50804.exe
        6⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1519.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32744.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51474.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        7⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        6⤵
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37081.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        5⤵
        
        PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        6⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        5⤵
        
        PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36184.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        5⤵
        
        PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12204.exe
      4⤵
      PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55627.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57371.exe
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        9⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37376.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14161.exe
        8⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        7⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34459.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        8⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        7⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3112.exe
        6⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        7⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
        6⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35185.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        6⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36690.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22575.exe
        7⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12273.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1928.exe
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57131.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        6⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38210.exe
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58011.exe
        8⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61058.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        8⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        7⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        6⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39065.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11306.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40020.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        5⤵
        
        PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33928.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        7⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10369.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
        6⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        6⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        5⤵
        
        PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45970.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45456.exe
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30847.exe
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33537.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
      4⤵
      PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50203.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37393.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        7⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7857.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16479.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62715.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42153.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
        5⤵
        
        PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        7⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47378.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6536.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        5⤵
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        5⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        5⤵
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
        5⤵
        
        PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      4⤵
      PID:15712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7578.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15713.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30696.exe
        5⤵
        
        PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56432.exe
      4⤵
      PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
      4⤵
      PID:12900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35851.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38677.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        6⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        5⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        5⤵
        
        PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
      4⤵
      PID:14944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      4⤵
      PID:14140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
    3⤵
    PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
    3⤵
    PID:16296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        9⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63449.exe
        9⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        9⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
        8⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12312.exe
        8⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        7⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 464
        8⤵
        Program crash
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22923.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63257.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21115.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20419.exe
        7⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58313.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65222.exe
        6⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16369.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
        8⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
        7⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15640.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        6⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31240.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38866.exe
        7⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20353.exe
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25506.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
        6⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15336.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        5⤵
        
        PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        6⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7594.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6200.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9144.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        6⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51611.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55282.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8376.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22847.exe
        5⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
        6⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5985.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        7⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52873.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47122.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        6⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
        5⤵
        
        PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56715.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36760.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59378.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33080.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        5⤵
        
        PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      4⤵
      PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31787.exe
      4⤵
      PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61595.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28927.exe
        7⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26369.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        6⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        7⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        6⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        5⤵
        
        PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25554.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15795.exe
        5⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      4⤵
      PID:12148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56779.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        7⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47204.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
      4⤵
      PID:15720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
        5⤵
        
        PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38813.exe
      4⤵
      PID:3704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
    3⤵
    PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
      4⤵
      PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19345.exe
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65485.exe
      4⤵
      PID:5124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9489.exe
    3⤵
    PID:9920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28935.exe
    3⤵
    PID:3336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        8⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25368.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31960.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6641.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        6⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        5⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17547.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29201.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48857.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1441.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        5⤵
        
        PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23474.exe
        5⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        6⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        7⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        7⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        6⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        7⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        6⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34929.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9473.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20716.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61113.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53161.exe
      4⤵
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        5⤵
        
        PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-168.exe
      4⤵
      PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58697.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        6⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        5⤵
        
        PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41784.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3880.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39250.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39716.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
      4⤵
      PID:14540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10394.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        5⤵
        
        PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41353.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
      4⤵
      PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46057.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47817.exe
      4⤵
      PID:16156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
    3⤵
    PID:10040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
    3⤵
    PID:13168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
    3⤵
    PID:1404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55394.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39384.exe
        7⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54525.exe
        6⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18609.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5384.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
      4⤵
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15873.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        5⤵
        
        PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19423.exe
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
      4⤵
      PID:13352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
      4⤵
      PID:16060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14984.exe
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25353.exe
      4⤵
      PID:14168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
      4⤵
      PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64809.exe
    3⤵
    PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28027.exe
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      4⤵
      PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
    3⤵
    PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27727.exe
    3⤵
    PID:13004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
    3⤵
    PID:6088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57298.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41227.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        5⤵
        
        PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2744.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33122.exe
      4⤵
      PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
    3⤵
    PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44496.exe
      4⤵
      PID:15748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2104.exe
    3⤵
    PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
    3⤵
    PID:12392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
    3⤵
    PID:15056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
      4⤵
      PID:13012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
    3⤵
    PID:9300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9400.exe
    3⤵
    PID:12868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
  2⤵
  PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47531.exe
    3⤵
    PID:8968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8520.exe
    3⤵
    PID:10484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
    3⤵
    PID:5568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
  2⤵
  PID:9516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50592.exe
  2⤵
  PID:12968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
  2⤵
  PID:15828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7924 -ip 7924
1⤵
PID:13068

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe

Filesize
468KB

MD5
65c758b6f012f29c20d75906605f8306

SHA1
e326f38dd74b21541339c4af38aca57c45129643

SHA256
f0759c275d2600fe1107c47af5bc4ca3582e00d83ad240ce773c8e2d4864beae

SHA512
7dd66bafa6e4f9a86150046bd99de37908f8242aaa589e412b765e7b53ba6629ee901291b206f21668c57c37ebe9596a9762954e556b8cad3bf261ae07da14b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe

Filesize
468KB

MD5
21022749bc499e3748fc666a371214c8

SHA1
55b01faaa350b808cac961b6a88db0e46a03d412

SHA256
857e32483634009a2f6b8dc2476a294b79c057864b2621ee290d6e00f3acc78f

SHA512
c8a1b82e66dbc54fd469b2ccc57d4feee86247cc3891109d9d0b5e35cef4a7a4bd021554cfc4f17d94ac82d07940fe43243960ea97a7555e95697cb5953229fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11978.exe

Filesize
468KB

MD5
31f578d694575b601b8c5b16b25147d7

SHA1
7ac7bc1eaa053402bedb29233b64caa8cd5b3bbd

SHA256
40bbe200dc8c698c73a9ae6586dc3cbf7329661cd1f031032a9495f969df7007

SHA512
24654c8b2a48526472da85b55efa87758a446fcf7faf83ba7895c7f8d65c618cd65f61cb4710317d17b2e5c36114ac106d97c75440ec18e5b567badbece0f1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe

Filesize
468KB

MD5
79b4182e3688230dc48dda6bc0108eac

SHA1
45aff0f7dcaf5bad4100a608f5b7ce5467442f16

SHA256
b11afaa9bd64de2c1a78f0b61cd726a9c0de6bcce35303d24d849b0eee90614d

SHA512
ac97ceb75032a5e51f3383e5ee6f84f04bb1bfbd040407cbcf671003720021fc1af707b814b89a28b246ac05f56f79cf09cd683753018a835787868445b6d4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe

Filesize
468KB

MD5
559cbae6b1ebec694424836a2aa12dfd

SHA1
5b7ff4cf3c8e34c95fe0480233b1899070c41174

SHA256
a9fd9a5c5ed0b8383dc77304913d58a736c3fae24d6f33b0e137aa01c0935573

SHA512
5b7eec352b29273dd5cbfa014de10e0bb154316bb822548bd4a53ede40bf56063788b4eba79770924914a809d35b9cbf1da888dca5278c323f4d9515d489e59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe

Filesize
468KB

MD5
d202eb2de862c3c3e67748d5b671be99

SHA1
2fd2dc2432a8c035e400e92fcf903d9920ea9dba

SHA256
c2142619082355a866102012e92ba984e789d5239e633bbd1adde6b96ea1ba8a

SHA512
980ffdf748220a74947f62abb16701555b01d5a73dfbd082cd8fee9bcd075004773f853542f205a8d21c4e4d9e868c601ac9aab6446c6014287296874133bfb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe

Filesize
468KB

MD5
428e81e33406408339d5a2e4331560b4

SHA1
f2c0ecd8a84932951d5e19f903f508a23c80c972

SHA256
cf7ade6feacaf46d2a6737e9405e5e0544afcf5e549c6804f79e45050af1d67d

SHA512
de9c7a84280ba07acb1cc59b390f8fcbc42e2c6a205938490a902bdcb34acb36df14f8a57eb16736053d6dd0d5e8d086fe6334a0e437c23c3ee3571d51e65e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe

Filesize
468KB

MD5
0317727dea5dbe3f7a828a8afa423b51

SHA1
aafe83ae49b5ef0f01b822b902cc09296bbcbf5f

SHA256
639a633095819f6f2aefd444251ef3b4e9f4c39eb739b6af66d93b02eccf6806

SHA512
88e9586aecf42ccf13a524d415e847a5f3be5b3b10756fbc50311b2ce6ad3e4218e80f017ad63106492e3ce0780fff6e99cf6be7ab0ab3cffeaba1828e02d397

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe

Filesize
468KB

MD5
c2c5a5a5a144e5f175f36408f3b49e67

SHA1
667c786a017005315f67a3183967e54b7f91e517

SHA256
e163618c116c482ade0d9984b961e37f76302d16b690785545999094c186dbbc

SHA512
3f9eba51a3a44b6e3e659d592da1a4edb554edad614a4b9b46d1da663ff1a476e5077e574e1dcad6f009cd698658400750943c512ae34ef94c01235faf3f657b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14817.exe

Filesize
468KB

MD5
e6a655c132fd04e487e82745a89b7f69

SHA1
c93b9ba6459d5c381762b5accd62089fa152021c

SHA256
7f67c34f88a87c92cf10b3e1df91d963fdc17a9fb35b184ae1bc8c29a669a954

SHA512
b015428a9dceea4b26badeeb19d3834f867e06c0682c13f958765d415f5622212aa40b993d75a54a0fe46b32beaaed8ba7e14e99be83179242dab39ee5272bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe

Filesize
468KB

MD5
3ba3564181d611032e92e26a591d950b

SHA1
de8749116626af0e79e3d02cbf0b8e9bff4aae70

SHA256
24916c4feaea2e2f0ad50ad1bfb1e5e68452790d6b8c81416b71860c8a59c3d6

SHA512
e2822eb6383c6b4358b8967b78119071647522bac6986743516524dcc2b459e72ace6a899285c02c74ab22edd7fa6dcf070a80e2a47562df81e64f00cbe776b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20491.exe

Filesize
468KB

MD5
f63b28dc9eb4347db9b8d5fca1ff1d9b

SHA1
de2431af13c2793990f71063b633327a572298a8

SHA256
609de041fd986532bead905bd9779c3c1b8b3894880639a3d32f2fe982c3f4b4

SHA512
7b9257e039e219696ea091fce92407bef2a7fcac33b4e010d333dd4edd15c087615863d2d1b339a4045a28aa72a1381798009703af83a18b34c71993d4be215f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23743.exe

Filesize
468KB

MD5
fe79f3956fd6ecb92d5b1211eba93008

SHA1
7ad334c2ad15a7ae7ec063323582cffafdfa294e

SHA256
720b2cb35df05a81dde773258c47cfc26a9243d4806eb226ce6dc0003286c779

SHA512
e4bfbe7c9a607632f3de996cea826672da24e464c46f7dda011549e3fe8e56452f4d7846a5cd9a89021003afb54f6ec2b8af7d7f0ade521f0e83b26e647059cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24815.exe

Filesize
468KB

MD5
da716ebdcdb610bc97011bdb7e223692

SHA1
11091caa364af13f66260fa0654315717aeabd32

SHA256
989647ba4de0e630562d276d60ed2d709ac47f5d488700a1bbabc78c6ffc7bfc

SHA512
6a44ee688e7933a1382e4826218bc0214497c6688139795184fbb5cf5947c83177d058d6fe10724c4d22ee15883a706342d2198629adfb3ac23ef34e78231098

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe

Filesize
468KB

MD5
86351d8a125273bd10310d44a9e3c10f

SHA1
5ccfa2fde543b773af8db31c7b49e27570f589a7

SHA256
ec226a5cdbd1d07e408aba6d4e6b3d03eb190545ea0628e5b3e8317e4f6556a1

SHA512
68b552c73e0dc6fac5d84a3ee2c01a28e83f589869558a5bfb662bd9ac9d1cd5fe14f668682cd11bc0338048664d4fde4cc1721460e65ab9dd66eda99166bfd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe

Filesize
468KB

MD5
6440f39b0cf98759221ddff60e6950ec

SHA1
7ac6ca71641354098ac198fbfcbfbdd19974b7ca

SHA256
4c853aee4c9bc0a67039b51a0f8f517a2daa287b78a9a414e479b324f75bc669

SHA512
67d20fafbcf7f8504d81b46bee462953f9f5b7ac4665df53147d587c148bfade5912ca3bb843881052ad83c159d846116b10e3d1178596105bde0ff31f6b9c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe

Filesize
468KB

MD5
926e6999a7ababa286cfc771b90c4369

SHA1
cc39f9d24f6a6bb2b3ee6e666d675c70935c9bff

SHA256
b4582c33e176a11760834ec37794d2d64b0cc55f1cc3732a5bfd5e52f0786638

SHA512
0d02c560ef046fda86c6b97380bc98c30948b47beef76388454b9f12af773343eed12a44258d03f4fadd612ef996c78074c2bbf6404a2d103a32a3d68914a339

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe

Filesize
468KB

MD5
7804db15c96f355157fd24ecbac80164

SHA1
06dfe3a0c7a90ce00f429a94b171bccefc625ae0

SHA256
4876afccc186cf86178e38544cd5f1093dd7173e43d0daefac09eb964c1186b5

SHA512
beec1074143c371d7d7c2a9acbedb979d32a12c98742079cfc1e7ee93189555a6b42d885222b8be9c024148c463c43db98ab03310dec56ff2bbb957b71be8f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe

Filesize
468KB

MD5
25a6039f41095b13a8b09e577f1b4856

SHA1
d10ce019806296d599b80306ce67f1d0154d4efe

SHA256
75701cf3bb67cba5efb2c262896a7e1fde1208a5932554ee182ddfab45c6130a

SHA512
596a5b1e22ef95dcc7f7a190448879990fee4ad1c99b22f1dc16be1e724f70a9bc20710af5eefbc620d731731ba87f74a083075baf1e60a176d63c6408d37ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41851.exe

Filesize
468KB

MD5
cc9d0aa71de0caccdd4ab686c45431ce

SHA1
e7f224dae7e1f0fe5afd90c578b4805aa4d2d41d

SHA256
327ef231df21bdbce65548b3243ad365d0748c89b74d4de4ae3019af3a909a89

SHA512
f599dbd1a53e43a2b4f07f9412643a2037db5b555d63ad4189d31af228aedc2223dc197f4d6fb3a5522b68567dc338e3264054a971674bd24a6fd2ee0d968273

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe

Filesize
468KB

MD5
bb661503d1343bcb3753ccc8d0f6bf53

SHA1
57d88cbcf13c18f3eb0822c77a6ffa6dee2e1829

SHA256
83f2bd8b52ef719e269c71d4a83d36e23201d448ec73523be72d41fcbca26bf2

SHA512
67b3a81a2713dd4f69318b1f17f159f20db5e2eb7d1bd3d1cb0d6f36b77b7d7e9f5c643c13ea1396be08093d8868a780e213bf29a71fddb68d5c5607089d4acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44843.exe

Filesize
468KB

MD5
b19d0123f7d1442b9af5a537d0e36b7b

SHA1
a10eafe7244b2d89e60cc52b2f67a6f0dd62ddc2

SHA256
7b21c415a7d909e41963361c7dd525ca1ad7150d7be2a07909064bbd32666fdc

SHA512
b62537c5138600c72e050e48492e16d38353c467ec3337b4db3d58d9930df5018f2ef6eae12a7d794c93bac8d0b8cf799cba85ea00bc4ed0e8131da47d9cb58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe

Filesize
468KB

MD5
7db9151ce4b67d9e1b5c0be7650919d9

SHA1
61dcf4762d2f10706ce7aa10921ebac40aa13913

SHA256
dac2e0a439b6f5b2f5ebd87a1056514bd51931a836fdc2f66beeff0fda6eaef4

SHA512
1cf19b2f5b227b4d03e13f652c408218163ccc51fcd05a128134b034cc709e47fe26c74ba1a2592f63e80edc6cd6c6072f34e2a2add03e8cb2e2c61e25252565

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe

Filesize
468KB

MD5
8e289f3b3150ba82f7039c39c85a3143

SHA1
bd6b982531aa0c508ab687ffb5c0a8da0b247f4e

SHA256
e06f9420afbdf963ce28012adb232c826e15629c846d4e38236c1ff667585e06

SHA512
4e71d5eab154e8508af601de8dbb0b5c3e16ef0d6413b0efbd5108acb9392fd74e384f6394576a50ad9adb065cde50d6a25df907be0b42755daef4b173d42826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe

Filesize
468KB

MD5
37f23036cb4d2fc2eda8b3325f5f0035

SHA1
4da11056326c8389eea5e3f136b55737b275b43d

SHA256
32a66296cdf20dfb38278a8ffd05022b43456004f35d54c6c54ef307807001f5

SHA512
a118bd05228e0a33ff4b9731b0d0d5d6f31bfb879842cd8a8a3f1fe87fd1963e9edb59cb3df1180dbcbba7da7f00c7a1beeec577268bb029bb77fb59cbda2817

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe

Filesize
468KB

MD5
bc941cbb99cc30ad1ab60a2971ef4b1a

SHA1
8994387ac967ce493bfb33a979fda097ef28ed3a

SHA256
e0036e92f5878a2015f1cd493e31d03cd6a1f8f63501de8b23a3de54111c6818

SHA512
278f55e650a6e21fdba2132153ce73903a1b0c5c6f8cdb70a8aec035cd4f12c4fcd135400dbb5790bfdeae029fed255cd8649f2b8b421eee27ef7bd7f29910e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5761.exe

Filesize
468KB

MD5
ee6a57d03c5e7110bc2ccc23575d3747

SHA1
c6f557c39bd6a5a4fa58f4b08610f820425c3f4c

SHA256
9db06f6e7dccda24b8a14c0227d1f9f04fb656cc9e8ef0f07db8a521aad0de83

SHA512
4646ea996da2e9bd508c148b93b548cd4a1e0a73c188bc0ff30fdf2ecf0bc8f278a99e8ade4cf0034a8d7492b157df08c2bc847a3c2294da458d2a219a668543

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57611.exe

Filesize
468KB

MD5
873706ab8f006d49352f539d8bdc4bd7

SHA1
ec3bbff2a8e769b761e4fa451907a1179fc00299

SHA256
c54fd4f41296cd21d9862bc56187f7190bf5a83ed29db5d029f96d0256754d44

SHA512
f86b727564ee2b15b3b40039c2eab7755a6781d592ff55cc36be6b83aa209ad340b4acdd58f57696a49535e08f06ea2650f706686cb8532ddb970f6ea1c9efdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe

Filesize
468KB

MD5
51454bab5db56215800ab805f3781511

SHA1
e2f3a14c410052d9839e876f263aeaf7d6fde7e1

SHA256
55c9837f7f45d8cf632c52787fb28e8b82bca0dfc7ff44399027bb659b1b1904

SHA512
8a35b6c4c9bdf8ffb23d3c2f6e338de1d9df087af8477a31747dc66706af7402b1f2f7c914ded281e339e8a0fa14cdc74b2125c5f31ed76a934a58fd0ca7f5f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59977.exe

Filesize
468KB

MD5
c732a019ad555414d57eeca67a6f0c50

SHA1
c50ba2d648b214b01066dce554005fff3579724b

SHA256
d7cba720792b1a8c13d65500b1baa9a22dedaee05787978596f0c213b089b41c

SHA512
eaf13bb756436267abc9887d091f12e8c6689630cd84259f63fa18c614e9d4f1bb571f1f126d067a053e1a4a3db1456988293e6185b642861960bf7ffaf487c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe

Filesize
468KB

MD5
2e1967647264665528c3dd47e2bd4a3d

SHA1
7eb9e4cd766b0ef8d20f15cacc11e5277226e202

SHA256
7d3d0c0f2ea49d00738797acb5f4e4fef4a67620ce6b38cf37c08f432862c946

SHA512
799cc7ca8e8253ad3eb40a1ebc9e8c36ae0dd7a904f423add9be9da569d42388a6d9cb62a797e7eaaa556f4b4cb9c9898d80dc067bc21aacdee9a7cb6db04516

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe

Filesize
468KB

MD5
b75a29fe0f33fcfea7a3d016b5c093e9

SHA1
adb2bf502f8e9ffe0ca78eeaeeb9e5b16007f1db

SHA256
c3d6a67e9b25cc822c11e325b1540e07561124279dfa09b0be97b92b98f3a4b1

SHA512
a1d8dd728505a1991fc5e75b4145fc2f0810c027b3c5679be330179d89bd94ab0766aeb9e10f31a141c35f5f649e59ef5910521f8852fd48b934efdc97bc4831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe

Filesize
468KB

MD5
89d480d7dd2c9badf885d6b065120bcf

SHA1
3fbb88748f42274db196b52e13aa2d3a87af5c5d

SHA256
738ac59e72022146101ef17a046e6c7fcca5f439de9657f17f87a473126754be

SHA512
a11004d3c3b3b8fb4236801ff4b57b0e16b2a6fdacbd7881804c793a74078ec74b0b4d2a70154e93ca8fe7b83e7ea63bfd0d3894db2072bbf879262e94324d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8472.exe

Filesize
468KB

MD5
b9355b2d9ebad1845f5871639d01ecac

SHA1
8d482ac148b2ddc4a9c5b26c8c39106ddd111bf0

SHA256
5d13b8b8d5dad280d055e5b08cfe188e7760189fc13fbb0a119e7d961f95eff1

SHA512
205237dc61f44d6369e2cf240ebb7d9d680ce954e9e11cd4551b364061c32e7d5f2f96f8ae3d921e4b94ee1b54a3f3d4b5d3738b3b5a5eb68271cfea7b981c0b

Download Submit
memory/216-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4580-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4632-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5080-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5500-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14224-2597-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads